Linux-Server-Management-Toolkit

cschantz/Linux-Server-Management-Toolkit

Files

T

cschantz 49b0bf3a90 Improve attack signature scoring for faster blocking

Issues Fixed:
1. SUSPICIOUS_UA under-valued (+10 → +15)
   - Automation tools now block in 6 hits instead of 8
   - Matches severity of SQL injection and path traversal

2. BOT_FINGERPRINT under-valued (+8 → +15)
   - Headless browsers now properly scored as HIGH risk
   - Blocks in 6 hits instead of 10

3. Suspicious bot penalty increased (+10 → +15)
   - Consistent with new SUSPICIOUS_UA scoring
   - Faster blocking of malicious automation

4. Legit bot penalty exploit fixed
   - Score reduction (-5) now ONLY applies if NO attacks detected
   - Prevents spoofed Googlebot/legitimate UAs from avoiding blocks
   - Attack detection overrides bot classification

Impact:
Before:
- SUSPICIOUS_UA: 8 hits to auto-block (score 80)
- BOT_FINGERPRINT: 10 hits to auto-block
- Spoofed Googlebot with attacks: Could avoid blocking

After:
- SUSPICIOUS_UA: 6 hits to auto-block (score 90)
- BOT_FINGERPRINT: 6 hits to auto-block (score 90)
- Spoofed legitimate UAs: No penalty if attacks present
- Faster response to automation attacks

Real-World Example:
IP with python-requests UA making SQL injection attempts:
- Old: +10 (SUSPICIOUS_UA) +10 (suspicious bot) = 20 per hit
- New: +15 (SUSPICIOUS_UA) +15 (suspicious bot) = 30 per hit
- Result: Blocks in 3 hits instead of 4

2026-01-06 17:28:35 -05:00

attack-patterns.sh

Improve attack signature scoring for faster blocking

2026-01-06 17:28:35 -05:00

attack-signatures.sh

Add missing function exports to library files

2026-01-02 16:23:17 -05:00

bot-signatures.sh

Security Intelligence Suite - Complete Overhaul

2025-11-13 23:01:13 -05:00

common-functions.sh

Fix menu standards: Replace plain dashes with Unicode separators